brand-research
Pass
Audited by Gen Agent Trust Hub on Apr 1, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
curlto interact with the brand.dev API and to download logo assets into the local file system. - [EXTERNAL_DOWNLOADS]: Fetches data and image files from the external
brand.devdomain. This is the primary function of the skill and uses standard HTTPS requests. - [PROMPT_INJECTION]: There is a potential for indirect prompt injection because the skill processes untrusted data (brand names and descriptions) from an external API.
- Ingestion points: Data enters the agent context from the
api.brand.devresponse as described inSKILL.md. - Boundary markers: No specific delimiters are defined for the fetched brand description.
- Capability inventory: The skill has file system write access (
mkdir,curl -o) and network access (curl). - Sanitization: The skill includes instructions to sanitize the domain input and format the brand slug (lowercase, hyphens instead of spaces) before using them in commands.
Audit Metadata